Performance evaluation of client-based traffic sniffing for very large populations

Current Internet users are demanding an increased mobility and service ubiquity, which, in turns, requires that Internet services are provided from different datacenters in the cloud. Traffic monitoring in such a mobile scenario, for security and QoS monitoring purposes, is rather challenging, as the sniffing points may be fully distributed in the operator’s network. To complicate matters, outgoing traffic may leave the network through a given PoP and return through a different one. As a result, traffic monitoring at the edges, at the very client terminal or domestic router, becomes a sensible alternative. However, such a measurement scheme implies that millions of tiny monitoring probes are continuously producing flow records, which builds up a significant load for the monitoring data collector and for the network itself, aside from the induced load to the client terminal or router. In this paper, we study whether such large scale deployment of microsniffers is feasible in terms of the resulting load, namely deployment of lightweight network probes that perform passive measurements at the client terminal. We further propose data summarization schemes to reduce load with minimum information loss.

Our findings show that deployment of a large populations of microsniffers is feasible, provided that adequate data thinning techniques are provided, as we propose in this paper.